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Address Resolution Protocol 

From Wikipedia, the free encyclopedia 

In computer networking, the Address Resolution Protocol (ARP) is the 
method for finding a host's hardware address when only its IP address is 
known. Due to the overwhelming prevalence of IPv4 and ethemet, ARP 
is primarily used to translate ethernet MAC addresses from IP addresses. 
It can, however, easily be used for IP over ATM or FDDI- 

ARP is used in four cases of two hosts communicating: 

1 . When two hosts are on the same network and one desires to send a 
packet to the other 

2. When two hosts are on different networks and must use a 
gateway/router to reach the other host 

3. When a router needs to forward a packet for one host through 
another router 

4. When a router needs to forward a packet for one host to the 
destination host on the same network 

The first case is used when two hosts are on the same physical network 
(i.e. 4 they can directly communicate without going through a router). The 
last three cases arc the most used over the internet as two computers on 
the internet are typically separated by more than 3 hops. 

Imagine computer A sends a packet to computer D and there are two routers, B & C, between them. Case 2 covers 
A sending to B; case 3 covers B sending to C; and case 4 covers C sending to D. 

ARP is defined in RFC 826 (http://ww.ietf.OTg/rfc^ 
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Variants of the ARP protocol 

ARP was not originally designed as an IP-only protocol although today it is primarily used to map IP addresses to 
MAC addresses. 

ARP can be used to resolve MAC to many different Layer 3 protocols. ARP has also been adapted to resolve 
other kinds of Layer 2 addresses; for example, ATMARP is used to resolve ATM NSAP addresses in the 
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Internet protocol suite 



j Layer 
; Application 



i Transport 



Protocols 

DNS, TLS/SSL, 
TFTP, FTP, HTTP, 
IMAP, IRC, NNTP, 
POP3, SIP, SMTP, 
SNMP, SSH, 
TELNET, 
BitTorrent, RTP, 
rlogin, ENRP, ... 
TCP,UDP, DCCP, 
SCTP, 1L, RUDP, 



! Network 



Xink 



IP (IPv4, IPv6), | 
ICMP, IGMr\ 
ARP, RARP,..- J 
Ethernet, Wi-Fi, ; 
Token ring, PPP, j 
SLIP, FDDI, ATM, j 
DTM, Frame Relay, ! 
SMDS,„. 
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Classical IP over ATM protocol. 

ARP Mediation 

ARP Mediation refers to the process of resolving Layer 2 addresses when different resolution protocols are used 
on either circuit, for e.g. ATM on one end and Ethernet on the other. 

Inverse ARP 

The Inverse Address Resolution Protocol, a.k.a. Inverse ASP or InARP, is a protocol used for obtaining Layer 
3 addresses (e.g. IP addresses) of other stations from Layer 2 addresses (e.g. the DLCT in Frame Relay networks). 
It is primarily used in Frame Relay and ATM networks, where Layer 2 addresses of virtual circuits are sometimes 
obtained from Layer 2 signalling, and the corresponding Layer 3 addresses must be available before these virtual 
circuits can be used- 

Comparison between ARP and RARP 

ARP translates Layer 3 addresses to Layer 2 addresses, therefore InARP can be viewed as its inverse. In addition, 
InARP is actually implemented as an extension to ARP- The packet formats are the same, only the operation code 
and the filled fields differ. 

RARP, like InARP, also translates Layer 2 addresses to Layer 3 addresses. However, RARP is used to obtain the 
Layer 3 address of the requesting station itself, while in TnARP the requesting station already knows its own 
Layer 2 and Layer 3 addresses, and it is querying the Layer 3 address of another station. RARP has since been 
abandoned in fiivor of BOOTP then DHCP. 

Packet structure 



The following is the packet structure used for ARP requests and replies. Note that the packet structure shown in 
the table has SHA ? SPA, THA, & TP A as 32-bit words but this is just for convenience — their actual lengths are 
determined by the hardware & protocol length fields. 





iware Bits 0 - 7 


8-15 ! 


16-31 




Hardware type (HTYPE) j 


Protocol type (PTYPE) 




Earihware length (HLEN) 


Protocol length (PLEN) i 


Operation (OPER) 




data 

— link — 


Sender hardware address (SHA) 




i ? 


layer 


Sender protocol address (SPA) 




1 ? 


protocol 


Target hardware address (THA) 




!7 


assigned 


Target protocol address (TP A) 





a 

number used in this field. For example, ethernet is 1 . 
Protocol type (PTYPE) 

Each protocol is assigned a number used in this field. For example, IPv4 is OxOSOO. 
Hardware length (HLEN) 

length in bytes of a hardware address. Ethernet addresses are 6 bytes long. 
Protocol length (PLEN) 

Length in bytes of a logical address, IPv4 address are 4 bytes long. 
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Operation 

Specifies the operation the sender is performing: 1 for request, and 2 for reply. 
Sender hardware address (SHA) 

Hardware address of the sender 
Sender protocol address (SPA) 

Protocol address of the sender. 
Target hardware address (THA) 

Hardware address of the intended receiver. This field is zero on request. 
Target protocol address (TP A) 

Protocol address of the intended receiver. 



Request 



a~ — , 



Bits 0 7 



8-15 



Hardware type = 1 



^v3& i Hardware length = 6 



Protocol length = 4 



16 -31 

Protocol type « 0x0800 



Operation = 1 



SHA = OX00095SD8 



SUA (cont'd) = 0x1 122 



.10.123 



SPA (cont'd) = 0x0A7B 



SPA-OxOAOA 



THA = 0x0000 



THA (cont'd) = 0x00000000 



TP A = Ox0A0A0A8C 



address of 00:09:58:D8:1 1:22 wants to send a packet to another host at 10.10.10. 140 (OxOAOAOASC) hut it does 
not know the MAC address then it must send an ARP request to discover the address. The packet shown shows 
what would be broadcasted over the local network. If the host 10.10.10. 140 is running and available then it would 
receive the ARP request and send the appropriate reply. 



Note that the IP address 10.10.10.123 is in dot-decimal notation and is converted to the hexadecimal form when 
used on the network (see IPv4 details). This is done by converting the four octets into hexadecimal (10 = OxOA; 
123 = 0x7B) to yield 0xOA.Ox0A.0x0A.0x7B and then concatenated together to yield OxOAOA0A7B since the 
decimals are not used in paekets. 

Also note that MAC addresses are shown in hexadecimal form and the octets are just simply concatenated 
together to yield the field value. 

Reply 



<W Bits 0-7™" I ~" 8-15 ~j * "l6 - 31 

, £ * — s — 

( ^ ; . Hardware type = 1 ; Protocol type = 0x0800 

i Hardware length = 6 1 Protocol length ^4 j ^ Operation = 2 

♦ Jox000958Ds""" 

|Wj SHA (cont'd ) = 0x33AA ; SP A = 0x0A0 A 

SPA (oonlM)' ^OA8C _ _ _ \ THA - 0x0009 

TH A (cont'd) = O xSSDS 1 122 

92- ' TP A = OxOAOAOA7B 

flie— - - : ■ ~ J 
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host 10.10.10.140 has a MAC address of 00:09:48:D8:33 AAthen it would send the shown reply packet. Note 
that the sender and target address blocks have been swapped (the sender of the reply is the target of the request; 
the target of the reply is the sender of the request). Furthermore the host 10.10.10.140 has filled in its MAC 
address in the sender hardware address. 

Any hosts on the same network as these two hosts would also see both the request and reply and they can cache 
the request result as well, thus saving those hosts from having to perform the same query. This is an advantage of 
a multiple-access bus like ethemet. 

See also 

■ Proxy ARP 

p Reverse ARP (RARP) 

■ Serial line ARP 

■ Zeroconf 

■ ARP spoofing 

External links 

h ARP Sequence Diagram (pdf) (http://ww.eventhelixxon^ 

■ RFC 2390 (http://www.ietf org/rfc/rfc2390.txt) - Inverse Address Resolution Protocol 

This article was originally based on material from the Free On-line Dictionary of Computing, which in 
licensed under the GFDL, 

Retrieved from n http://en. wiktpedia.org/wild/Addcess_Resolution_Protocol" 
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